Re: Precise OS detection of Windows over port 445?

[Ron <ron () skullsecurity net>]

On Thu, 3 Jun 2010 08:39:35 -0600 David Fifield <david () bamsoftware com>
wrote:
> Try adding "-O --script=smb-os-discovery" to your command line. When
> conditions are good, the OS detection is very accurate, but it might
> be overly specific. smb-os-discovery will always be correct unless the
> remote system is actively lying.
>
> You can also try a UDP scan to port 161 with the snmp-win32-* scripts.
>
> David Fifield
smb-os-discovery reads the information directly from Windows, it isn't a guess, so it should be 100% accurate. 

But, not all versions of Windows will advertise details like service pack, so you might not be able to narrow it down 
enough. Metasploit has some way of detecting the service pack that Nmap doesn't -- I've been meaning to look into that 
for awhile. 

-- 
Ron Bowes
http://www.skullsecurity.org
http://www.twitter.com/iagox86

Attachment: _bin
Description:

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/